dependency cleanup (#2011)

- async-timeout is not used anywhere (nor core neither extensions)
- cerberus is not used anywhere (nor core neither extensions)
- move embit and secp256k1 to end of the list
  - these are not used by core
  - document which extensions use them

pyproject.toml

@@ -9,7 +9,6 @@ python = "^3.10 | ^3.9"
 bech32 = "1.2.0"
 click = "8.1.7"
 ecdsa = "0.18.0"
-embit = "0.7.0"
 fastapi = "0.103.1"
 httpx = "0.25.0"
 jinja2 = "3.0.1"
@@ -28,17 +27,18 @@ websockets = "11.0.3"
 loguru = "0.7.2"
 grpcio = "1.58.0"
 protobuf = "4.24.3"
-Cerberus = "1.3.4"
-async-timeout = "4.0.3"
 pyln-client = "23.8"
 pywebpush = "1.14.0"
 slowapi = "0.1.8"
 python-dotenv = "1.0.0"
 websocket-client = "1.6.3"
-secp256k1 = "0.14.0"
 pycryptodomex = "3.19.0"
 packaging = "23.1"
 bolt11 = "2.0.5"
+# needed for boltz, lnurldevice, watchonly extensions
+embit = "0.7.0"
+# needed for cashu, lnurlp, nostrclient, nostrmarket, nostrrelay extensions
+secp256k1 = "0.14.0"
 # keep for backwards compatibility with lnurlp and cashu
 environs = "9.5.0"